Encryption must be used for OWA access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-33585	Exch-1-203	SV-44005r3_rule		Medium

Description
This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including CAC enabled pre-authentication through an application firewall proxy. Failure to require secure connections on a web site increases the potential for unintended eavesdropping or data loss.

Description

This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including CAC enabled pre-authentication through an application firewall proxy. Failure to require secure connections on a web site increases the potential for unintended eavesdropping or data loss.

STIG	Date
Exchange 2010 Client Access Server STIG	2017-01-03

Details

Check Text ( C-41692r3_chk )
Open the Windows PowerShell Modules and enter the following command: Import-module webadministration IIS: cd Sites cd “Default Web Site” cd owa PS IIS:\Sites\Default Web Site\owa> Get-WebConfigurationProperty -filter /system.webServer/security/access -name sslflags Review the result and verify only TLSv1.0 or higher is returned. If not, this is a finding.

Fix Text (F-37477r1_fix)
Configure the OWA site to require SSL port 443.